CVE-2021-47492

What it actually does

collapse_file in mm/thp fails to bail out early on PG_writeback pages when xfs uses blocksize >= pagesize (no page->private), allowing end_page_writeback to hit VM_BUG_ON_PAGE on zero refcount and trigger kernel panic via iomap paths.

Why it matters to the business

Systems using XFS with transparent huge pages can experience unexpected kernel panics and full system crashes during file writeback and khugepaged activity, causing downtime and potential data loss on affected Ubuntu deployments; the 880-day-old issue with no KEV status still requires prompt kernel updates to prevent operational disruption.

How an attack unfolds

An attacker with local access triggers concurrent file writeback on XFS and khugepaged collapse operations on the same pages; the missing writeback check lets the collapse proceed, causing the XFS end_page_writeback path to panic the kernel when the page refcount assertion fails.

How to fix it

Upgrade affected mysql-8.0 packages on Ubuntu 20.04 LTS and 22.04 LTS to the fixed versions 8.0.34-0ubuntu0.20.04.1 or 8.0.34-0ubuntu0.22.04.1 respectively; apply the corresponding kernel update that includes the early bail-out for writeback pages in collapse_file.

How to confirm the fix worked

Confirm kernel version contains the mm/thp collapse_file PG_writeback check; reproduce by exercising XFS writeback under memory pressure with THP enabled and verify absence of the VM_BUG_ON_PAGE in end_page_writeback.

Typical attack path

1. attain local unprivileged access on XFS-based system
2. induce writeback on target file via application or I/O workload
3. trigger khugepaged collapse_file on the same mapping
4. force race window that skips PG_writeback handling
5. observe kernel BUG and panic in end_page_writeback

How to detect it

Search kernel logs for 'Bad page state in process khugepaged', 'VM_BUG_ON_PAGE' in mm.h, or 'Oops - BUG: Fatal exception in interrupt' involving xfs_address_space_operations and end_page_writeback; inspect crash dumps for pages with writeback flag set and zero refcount.

• page dumped because: VM_BUG_ON_PAGE(((unsigned int) page_ref_count(page) + 127u <= 127u))
• BUG: Bad page state in process khugepaged
• aops:xfs_address_space_operations
• end_page_writeback+0x1c0/0x214
• iomap_finish_page_writeback

What your security team should do

• Prioritize kernel package updates on all XFS hosts within the next maintenance window
• Disable THP temporarily on high-risk XFS systems if immediate patching is delayed
• Monitor khugepaged and XFS writeback activity for panic signatures
• Audit for any custom kernels missing the fix